Security1 publisher2 min readPublished
A crafted URL runs attacker script inside an authenticated Teamcenter session
CVE-2026-58113 sits in the /auth/ redirect flow of Siemens Teamcenter. The attacker needs no credentials and no more than a link an engineer loads, and Siemens has shipped fixed builds for four release branches.
The Watch · Security desk
What happened
- CISA advisory ICSA-26-258-07 covers CVE-2026-58113, a reflected cross-site scripting flaw in the /auth/ authentication redirect flow of Siemens Teamcenter that an unauthenticated remote attacker can trigger with a crafted URL.
- Four release branches are affected below specific builds: V2412.0013, V2506.0010, V2512.2607 and V2606.2607, all of which Siemens has released as fixes.
- Enzo Alvarez of Bishop Fox reported the vulnerability to Siemens, whose Teamcenter installations CISA places in the Critical Manufacturing and Information Technology sectors worldwide.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- exposure The vulnerable endpoint answers before authentication, so the population that can serve the payload is anyone who can reach the Teamcenter web front end, while the person who gets burned is the engineer holding a live session.
- constraint Segmentation and firewalls limit who reaches the host, but they do not govern which links an authenticated engineer loads from inside the perimeter. This attack starts there.
- decision Sites that route CWE-79 findings into a quarterly backlog now have to decide whether the login redirect on an engineering system waits that long, on up to four branches at once.
Reflected cross-site scripting needs a victim to load the link. CVE-2026-58113 is delivered the same way, and on an engineering network that is a low bar, because the attacker needs no Teamcenter account and the target needs only a live session [1].
CISA describes the defect as an encoding failure. The /auth/ endpoint reflects user-supplied input into HTML attribute contexts without properly encoding it, which lets arbitrary JavaScript run in the browser of an authenticated user who loads the crafted URL [3][4]. The endpoint sits in the authentication redirect flow, so it answers before anyone logs in [1]. The advisory files the flaw under CWE-79 [8]. Scope is the session: exploitation may let the attacker read data or perform actions inside the victim's Teamcenter session [2].
Four supported branches are listed - V2412 before V2412.0013, V2506 before V2506.0010, V2512 before V2512.2607, and V2606 before V2606.2607 [6]. Fixing one CVE means four update jobs [14]. The fixed builds for V2512 and V2606 both end in 2607, so those two branches took the fix in the same build train [15]. Siemens has released the new versions and directs customers to its product support page [7].
CISA's standing advice for this class of advisory is to keep control system networks off the internet, put them behind firewalls, and isolate them from business networks [11]. That reduces who can reach the Teamcenter web front end from outside. It does not close the path this bug uses, because the request originates inside: an engineer with a session loads a link pointing at the internal host, and the browser makes the request.
Enzo Alvarez of Bishop Fox reported the vulnerability to Siemens, which published its own advisory as SSA-157465 [10][12]. The CISA advisory carries no CVSS score and no report of exploitation in the wild [13]. Teamcenter is deployed worldwide, and CISA lists the affected sectors as Critical Manufacturing and Information Technology [9].
What to watch
- A CVSS score, or a KEV listing for CVE-2026-58113, would move this from a scheduled update to a deadline.
- Whether Siemens updates SSA-157465 with further affected products or additional fixed builds.
- Reports of the same authentication-redirect reflection in other Siemens web front ends.